CVE-2025-38499 — Incorrect Privilege Assignment in Linux
Severity
5.5MEDIUMNVD
OSV3.2
EPSS
0.0%
top 95.83%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedAug 11
Latest updateMar 25
Description
In the Linux kernel, the following vulnerability has been resolved:
clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns
What we want is to verify there is that clone won't expose something
hidden by a mount we wouldn't be able to undo. "Wouldn't be able to undo"
may be a result of MNT_LOCKED on a child, but it may also come from
lacking admin rights in the userns of the namespace mount belongs to.
clone_private_mnt() checks the former, but not the latter.
There's…
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 1.8 | Impact: 3.6
Affected Packages4 packages
▶CVEListV5linux/linux427215d85e8d1476da1a86b8d67aceb485eb3631 — 36fecd740de2d542d2091d65d36554ee2bcf9c65+13
Also affects: Debian Linux 11.0